2022 CVEs (page 127)
Page 127 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36781 | Medium | 5.3 | 2022-09-28 | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiti… |
CVE-2022-23716 | Medium | 5.3 | 2022-09-28 | A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in t… |
CVE-2022-1270 | High | 7.8 | 2022-09-28 | In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. |
CVE-2022-3193 | Medium | 6.1 | 2022-09-28 | An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails to sanitize the entry… |
CVE-2022-40929 | Critical | 9.8 | 2022-09-28 | XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and support… |
CVE-2022-39236 | Medium | 4.3 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede… |
CVE-2022-38934 | Low | 3.3 | 2022-09-28 | readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file. |
CVE-2022-3354 | Low | 3.5 | 2022-09-28 | A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-m… |
CVE-2022-36771 | Medium | 6.5 | 2022-09-28 | IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID… |
CVE-2022-36448 | High | 8.2 | 2022-09-28 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the Pnp… |
CVE-2022-35722 | Medium | 5.4 | 2022-09-28 | IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-35282 | Medium | 6.5 | 2022-09-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacke… |
CVE-2022-22387 | Medium | 5.4 | 2022-09-28 | IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2022-40942 | Critical | 9.8 | 2022-09-28 | Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time. |
CVE-2022-40912 | Medium | 6.1 | 2022-09-28 | ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to the GET parameter 'action' is not prop… |
CVE-2022-40083 | Critical | 9.6 | 2022-09-28 | Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attacker… |
CVE-2022-40082 | High | 7.5 | 2022-09-28 | Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function. |
CVE-2022-39261 | High | 7.5 | 2022-09-28 | Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader lo… |
CVE-2022-28816 | Medium | 6.1 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentil… |
CVE-2022-28815 | Low | 2.7 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulner… |
CVE-2022-28814 | Critical | 9.8 | 2022-09-28 | Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability w… |
CVE-2022-28813 | High | 7.5 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to… |
CVE-2022-28812 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentia… |
CVE-2022-28811 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input valida… |
CVE-2022-22526 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API. |
CVE-2022-22525 | High | 7.2 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due… |
CVE-2022-22524 | Critical | 9.4 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerab… |
CVE-2022-22523 | High | 7.5 | 2022-09-28 | An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows… |
CVE-2022-22522 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentia… |
CVE-2022-40486 | High | 8.8 | 2022-09-28 | TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a c… |
CVE-2022-3349 | Medium | 6.8 | 2022-09-28 | A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handl… |
CVE-2022-2760 | Medium | 4.3 | 2022-09-28 | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a re… |
CVE-2022-30935 | Critical | 9.1 | 2022-09-28 | An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomne… |
CVE-2022-32170 | Medium | 4.3 | 2022-09-28 | The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “A… |
CVE-2022-32169 | Medium | 4.3 | 2022-09-28 | The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues… |
CVE-2022-32166 | Medium | 6.1 | 2022-09-28 | In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an… |
CVE-2022-3348 | Medium | 4.9 | 2022-09-28 | Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is need… |
CVE-2022-32168 | High | 7.8 | 2022-09-28 | Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arb… |
CVE-2022-3333 | Low | 3.5 | 2022-09-28 | A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/cr… |
CVE-2022-3332 | Medium | 6.3 | 2022-09-28 | A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System. This affects an unknown part of the file router.php of… |
CVE-2022-39054 | Medium | 6.1 | 2022-09-28 | Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthenticated remote attacker can inject Java… |
CVE-2022-39053 | Medium | 6.1 | 2022-09-28 | Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Sit… |
CVE-2022-39035 | Medium | 6.1 | 2022-09-28 | Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inj… |
CVE-2022-39034 | Medium | 6.5 | 2022-09-28 | Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker wit… |
CVE-2022-39033 | Critical | 9.8 | 2022-09-28 | Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unau… |
CVE-2022-39032 | High | 8.8 | 2022-09-28 | Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to a… |
CVE-2022-39031 | Medium | 5.3 | 2022-09-28 | Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Sessi… |
CVE-2022-39030 | High | 7.5 | 2022-09-28 | smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to acces… |
CVE-2022-39029 | Medium | 6.5 | 2022-09-28 | Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to… |
CVE-2022-38699 | Medium | 5.9 | 2022-09-28 | Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privile… |
CVE-2022-40497 | High | 8.8 | 2022-09-28 | Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Acti… |
CVE-2022-41604 | High | 8.8 | 2022-09-27 | Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRA… |
CVE-2022-41571 | Critical | 9.8 | 2022-09-27 | An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur. |
CVE-2022-41570 | Critical | 9.8 | 2022-09-27 | An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur. |
CVE-2022-40878 | High | 8.8 | 2022-09-27 | In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE). |
CVE-2022-40877 | Critical | 9.8 | 2022-09-27 | Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter. |
CVE-2022-40817 | Medium | 4.3 | 2022-09-27 | Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some… |
CVE-2022-40816 | Medium | 6.5 | 2022-09-27 | Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal… |
CVE-2022-40354 | High | 7.2 | 2022-09-27 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php. |
CVE-2022-40353 | High | 7.2 | 2022-09-27 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php. |
CVE-2022-40352 | High | 7.2 | 2022-09-27 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php. |
CVE-2022-40199 | Low | 2.7 | 2022-09-27 | Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated… |
CVE-2022-3324 | High | 7.8 | 2022-09-27 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. |
CVE-2022-3323 | High | 7.5 | 2022-09-27 | An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 808… |
CVE-2022-3303 | Medium | 4.7 | 2022-09-27 | A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SND… |
CVE-2022-39835 | Medium | 5.3 | 2022-09-27 | An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. Th… |
CVE-2022-38975 | Medium | 5.4 | 2022-09-27 | DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an a… |
CVE-2022-38932 | High | 7.8 | 2022-09-27 | readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file. |
CVE-2022-38335 | Medium | 5.4 | 2022-09-27 | Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules. |
CVE-2022-37346 | Critical | 9.8 | 2022-09-27 | EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vul… |
CVE-2022-37209 | High | 8.8 | 2022-09-27 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-37193 | High | 7.4 | 2022-09-27 | Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation ev… |
CVE-2022-37028 | Medium | 5.4 | 2022-09-27 | ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will… |
CVE-2022-34326 | High | 7.5 | 2022-09-27 | In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX t… |
CVE-2022-31367 | High | 8.8 | 2022-09-27 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. |
CVE-2022-23006 | Low | 1.8 | 2022-09-27 | A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessi… |
CVE-2022-39258 | High | 8.1 | 2022-09-27 | mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links… |
CVE-2022-39256 | Critical | 9.0 | 2022-09-27 | Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on… |
CVE-2022-3298 | High | 7.5 | 2022-09-26 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-40099 | High | 7.2 | 2022-09-26 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense_category.ph… |
CVE-2022-40098 | High | 7.2 | 2022-09-26 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php. |
CVE-2022-40097 | High | 7.2 | 2022-09-26 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_currency.php. |
CVE-2022-40050 | Critical | 9.8 | 2022-09-26 | ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1. |
CVE-2022-30004 | Critical | 9.8 | 2022-09-26 | Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL databa… |
CVE-2022-3290 | High | 7.5 | 2022-09-26 | Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-30003 | Medium | 5.4 | 2022-09-26 | Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products co… |
CVE-2022-3272 | High | 7.5 | 2022-09-26 | Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-22058 | High | 8.4 | 2022-09-26 | Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… |
CVE-2022-40784 | High | 8.8 | 2022-09-26 | Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406. |
CVE-2022-40044 | Medium | 5.4 | 2022-09-26 | Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notificat… |
CVE-2022-40043 | High | 8.8 | 2022-09-26 | Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalati… |
CVE-2022-3201 | Medium | 5.4 | 2022-09-26 | Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to instal… |
CVE-2022-3200 | High | 8.8 | 2022-09-26 | Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-3199 | High | 8.8 | 2022-09-26 | Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2022-3198 | High | 8.8 | 2022-09-26 | Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromi… |
CVE-2022-3197 | High | 8.8 | 2022-09-26 | Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromi… |
CVE-2022-3196 | High | 8.8 | 2022-09-26 | Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromi… |
CVE-2022-3195 | High | 8.8 | 2022-09-26 | Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML p… |
CVE-2022-3075 | Critical | 9.6 | 2022-09-26 | Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2022-3071 | High | 8.8 | 2022-09-26 | Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific U… |